Package net.shibboleth.idp.saml.saml2.profile.impl

Class ProcessRequestedAuthnContext

java.lang.Object

net.shibboleth.shared.component.AbstractInitializableComponent

org.opensaml.profile.action.AbstractProfileAction

org.opensaml.profile.action.AbstractConditionalProfileAction

net.shibboleth.idp.profile.AbstractProfileAction

net.shibboleth.idp.authn.AbstractAuthenticationAction

net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext

All Implemented Interfaces:

Component, DestructableComponent, InitializableComponent, ProfileAction, Aware, MessageSource, MessageSourceAware, Action

public class ProcessRequestedAuthnContext
extends AbstractAuthenticationAction

An authentication action that processes the RequestedAuthnContext in a SAML 2 AuthnRequest, and populates a RequestedPrincipalContext with the corresponding information.

If this feature is disallowed by profile configuration, then an error event is signaled.

Each requested context class or declaration reference is translated into a custom Principal for use by the authentication subsystem to drive flow selection.

Event:

EventIds.PROCEED_EVENT_ID, EventIds.INVALID_MSG_CTX, EventIds.ACCESS_DENIED

Field Summary

Fields

Modifier and Type	Field	Description
private AuthnRequest	authnRequest	The request message to read from.
private Function<ProfileRequestContext,AuthnRequest>	authnRequestLookupStrategy	Lookup strategy function for obtaining AuthnRequest.
private Set<String>	ignoredContexts	Context URIs to ignore in a request.
private final org.slf4j.Logger	log	Class logger.
private Function<ProfileRequestContext,RelyingPartyContext>	relyingPartyContextLookupStrategy	Strategy used to look up a RelyingPartyContext for configuration options.

Constructor Summary

Constructors

Constructor	Description
ProcessRequestedAuthnContext()	Constructor.

Method Summary

Modifier and Type	Method	Description
protected void	doExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)	Performs this authentication action.
protected boolean	doPreExecute(ProfileRequestContext profileRequestContext, AuthenticationContext authenticationContext)	Performs this authentication action's pre-execute step.
void	setAuthnRequestLookupStrategy(Function<ProfileRequestContext,AuthnRequest> strategy)	Set the strategy used to locate the AuthnRequest to read from.
void	setIgnoredContexts(Collection<String> contexts)	Set the context class or declaration URIs to ignore if found in a request.
void	setRelyingPartyContextLookupStrategy(Function<ProfileRequestContext,RelyingPartyContext> strategy)	Set the strategy used to return the RelyingPartyContext for configuration options.

Methods inherited from class net.shibboleth.idp.authn.AbstractAuthenticationAction

doExecute, doPreExecute, setAuthenticationContextLookupStrategy

Methods inherited from class net.shibboleth.idp.profile.AbstractProfileAction

doExecute, execute, getBean, getBean, getMessage, getMessage, getMessage, getParameter, getParameter, getProfileContextLookupStrategy, getRequestContext, getResult, setMessageSource, setProfileContextLookupStrategy

Methods inherited from class org.opensaml.profile.action.AbstractConditionalProfileAction

getActivationCondition, setActivationCondition

Methods inherited from class org.opensaml.profile.action.AbstractProfileAction

doPostExecute, doPostExecute, ensureHttpServletRequest, ensureHttpServletResponse, execute, getHttpServletRequest, getHttpServletRequestSupplier, getHttpServletResponse, getHttpServletResponseSupplier, getLogPrefix, isPreExecuteCalled, setHttpServletRequestSupplier, setHttpServletResponseSupplier

Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

checkComponentActive, checkSetterPreconditions, destroy, doDestroy, doInitialize, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface net.shibboleth.shared.component.InitializableComponent

initialize, isInitialized

Field Details

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

relyingPartyContextLookupStrategy

@Nonnull
private Function<ProfileRequestContext,RelyingPartyContext> relyingPartyContextLookupStrategy

Strategy used to look up a RelyingPartyContext for configuration options.

authnRequestLookupStrategy

@Nonnull
private Function<ProfileRequestContext,AuthnRequest> authnRequestLookupStrategy

Lookup strategy function for obtaining AuthnRequest.

ignoredContexts

@Nonnull
private Set<String> ignoredContexts

Context URIs to ignore in a request.

authnRequest

@NonnullBeforeExec
private AuthnRequest authnRequest

The request message to read from.

Constructor Details

ProcessRequestedAuthnContext

public ProcessRequestedAuthnContext()

Constructor.

Method Details

setRelyingPartyContextLookupStrategy

public void setRelyingPartyContextLookupStrategy(@Nonnull
 Function<ProfileRequestContext,RelyingPartyContext> strategy)

Set the strategy used to return the RelyingPartyContext for configuration options.

Parameters:

strategy - lookup strategy

Since:

3.3.0

setAuthnRequestLookupStrategy

public void setAuthnRequestLookupStrategy(@Nonnull
 Function<ProfileRequestContext,AuthnRequest> strategy)

Set the strategy used to locate the AuthnRequest to read from.

Parameters:

strategy - lookup strategy

setIgnoredContexts

public void setIgnoredContexts(@Nonnull
 Collection<String> contexts)

Set the context class or declaration URIs to ignore if found in a request.

This defaults to only AuthnContext.UNSPECIFIED_AUTHN_CTX.

Parameters:

contexts - contexts to ignore

doPreExecute

protected boolean doPreExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Performs this authentication action's pre-execute step. Default implementation just returns true.

Overrides:

doPreExecute in class AbstractAuthenticationAction

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context

Returns:

true iff execution should continue

doExecute

protected void doExecute(@Nonnull
 ProfileRequestContext profileRequestContext,
 @Nonnull
 AuthenticationContext authenticationContext)

Performs this authentication action. Default implementation throws an exception.

Overrides:

doExecute in class AbstractAuthenticationAction

Parameters:

profileRequestContext - the current IdP profile request context

authenticationContext - the current authentication context